PT-2019-15561 · Google+1 · Android+1

Published 2019-11-02 · Updated 2021-07-21 · CVE-2019-18659

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions LTE phones (affected versions not specified)

Description The issue concerns the Wireless Emergency Alerts (WEA) protocol, which lacks cryptographic authentication, allowing remote attackers to spoof a Presidential Alert. This can be demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). Testing has suggested that all LTE phones are affected by design, regardless of the operating system used, such as Android or iOS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2019-18659

Affected Products

Android

Ios

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-18659 · Security Note
• https://dl.acm.org/citation.cfm?id=3326082 · Note